Possible fix(deps): 3 vulnerable dependencies in package-lock.json

[begininvoke]

Spotted what might be an issue in package-lock.json around line 8498.

The installed shell-quote (v1.8.3) uses Array.prototype.concat as a reducer in its parse() function, causing the array to be re‑copied on each iteration. This makes parsing O(n²) and allows an attacker who can supply a long, space‑separated string to monopolize the single‑threaded Node.js event loop, leading to a denial‑of‑service (DoS). No code execution or data leakage occurs, but the impact on availability is severe, warranting a HIGH severity rating. Upgrade to a fixed version (≥ 1.8.5, preferably 1.9.0) to replace the inefficient implementation with a linear‑time algorithm.

Something like this might fix it:

```diff
--- a/package-lock.json
+++ b/package-lock.json
@@
-        "name": "shell-quote",
-        "version": "1.8.3",
-        "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz",
-        "integrity": "sha512-OLD_HASH==",
+        "name": "shell-quote",
+        "version": "1.9.0",
+        "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz",
+        "integrity": "sha512-NEW_HASH==",
         "requires": {
@@
```

For reference: rule CVE-2026-13311. Rated high.

If I have misread how this is used, sorry for the noise — feel free to close.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.